hxxps://trail-edf-valcenis[.]com/

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://trail-edf-valcenis.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
3880	msedge.exe
3880	msedge.exe
936	identity_helper.exe
936	identity_helper.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 372	3880	msedge.exe	84
PID 3880 wrote to memory of 372	3880	msedge.exe	84
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 3240	3880	msedge.exe	85
PID 3880 wrote to memory of 2544	3880	msedge.exe	86
PID 3880 wrote to memory of 2544	3880	msedge.exe	86
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87
PID 3880 wrote to memory of 4936	3880	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://trail-edf-valcenis.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b18146f8,0x7ff9b1814708,0x7ff9b1814718
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17879557182084630011,13343533835980380685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x41c 0x4c0
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d76ca81a4c33e6764445156ce1cff45e

SHA1
8b6bbb1a41034ab65cec2009384663752069f14d

SHA256
ac3f75bde4005a0c414adf9e81eaa16ab6935fc2cac10f9f5b5375b6c8db039d

SHA512
cc69f8959699e6dea032a50b041f52a758c1d3c78488774f1a997cb8e1ff58f34eeb5990f0e7f6ec30955e69098e9596a8b139b9d5b6d05a58b9af16a699c36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f608247c121d0677c059bdcc7821417f

SHA1
8cfb2f18c3316a763c34c1d6c047a12fa01a5001

SHA256
541c229bdefd245853353e1ac75026a6f4f9f54b94c5935c392751a4ceea0b9e

SHA512
cccd31a800defc2f6d91f98f1a8143f0f1b4d99b1d97fd1e18acc12afec5390c7466485589ee2deb5043d5cfd4ce3bb8c4f1111fa21f6fc6ad3ef081368343fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41e1ab0db36609397a504ebfd76a8b19

SHA1
85e5a696fb987644d12d76ad2e2ca98e649ca957

SHA256
3a6d9135472b3e9b44d209d2e84908fa8eea79ffe33a97f0573d7541f66dbd40

SHA512
93956e58d19c7620fb1c3d1977c76942ab4d35ccc3956c987f45c76ff2f3877e5c1ea55acab11fb425baf71d825e22facff3ee2a39b6ce033f53ab339e9c99ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b31f41bef9a9737f858222368c3c02ad

SHA1
2e116b149df6b9b0777af7653b65fa028ca9f86b

SHA256
1d7611a394be11155ce717bbb5f82d9bac7d85ddcd5d9a0f0618f62fa75d7aae

SHA512
a402ef5fe5bc958d58101d0c58353b2a4f60752de668a1d3e5973903b8c4717c60b1aaf41b1cd83a9c844fcd823d77f2b07a157a45b0100e84bd046f8be75ce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
adf8dd1f09724968e5f8846619bfcf8b

SHA1
78649154e18b569a2bf8945f6640a3e4777b2f1e

SHA256
bbf523547a67ebd7f4486a7a09544de51585627dd4f271cc2bcde7fb6533324e

SHA512
a48ccdb231d730a80a3f5643a6a96d51567866f59cd89e3b166651ed08b4c4e2d08a01d4437c019e6d71bf20ed25b5012b01576b4c7f6cbd3933e7c1ec6cdadc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b7cac2a67c95ab444e81e5f2594e95d

SHA1
9a13527a2102163c7218873598dc5861c86dc042

SHA256
04fedb30edf32746db2a511bf681f8a4663ca1f8178b3adc68f32011288d402b

SHA512
b470e9c074d6f41a83eaade0b86dff0e21af309a15ed13b9334fb4b7001d613c2051f6a8ec422b67a43d68d2907373ff53c14713cfda132f1c69ebcd5dd1d7da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
80c015869ca8ab76ced4a101accd799a

SHA1
175acb556cd3f762362a97264db014b1ada1ce1f

SHA256
69de2c993cd70654966865a359945c7a2edb2f34e6cb0eabb4055b50e477773a

SHA512
6c218290919ab009d17d266baa2265f5e9ac31eb84fe4f86711befe3e0529f248a0737063a798704b7af9569a2ba0f879c08e51ea35510111a606c23721914d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c71b443689a0beda819ba655232e620

SHA1
a6b77314cfdac79ddc0b3392d6480f1a0caf40fc

SHA256
c2c82f72cc77a0fc9ada3c825f2da5a5b7760c2198815d50252fd3cba7c9c7c4

SHA512
66992f3cc0e3524abf268f30a06527b182fd55a14cdcfecaa3d260bae7f1790ec52d1aa99f2ea63740302b3c090b23352e93e782fe0c24672403f9794d7eb351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eebab1f091eb65d8b6754efdb920bd2b

SHA1
3edf9f37ed64068cb31f55494d1bb6d7494112c3

SHA256
ce00c29a7c226dbf9fbd7cb2aa3bb016ffc56fc067da22e78e28bfa609e805ea

SHA512
02ef894620e47fd9d584d0796f2eb4d139e92c5b3b1f606e165d468389d3d8f2e2cbf72715ed85ce334f5da4aef6ac7af8d37da0c0b1984e5663a6d72f718793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ec35.TMP

Filesize
1KB

MD5
a43b96614d27a471494a2d4a637808dd

SHA1
a6e2a3a2db70cbc55b4d66921a3b26229936d8dc

SHA256
01dfa52694d566dddfff380ab75eb7ea4ad79e3442714a7c73cee7859d8bf06d

SHA512
e22ca94b73eef10d569d8348180ca713edd17750b67b8758b298c35c10def837bb083b12a0ea411efb49024d8649b111a7078db31f1a214d7c1ffea6e0fe25cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce9b756153353d6220ed17e17f2d8f2f

SHA1
76866f1685ddeed224b225311073424eae7360d3

SHA256
f1dfb2c52dca375225094de54ef1055f5f8f953d88d1f63dda65f01ffb807707

SHA512
b39aaf8ea14a34cec57677ea5d129012997e1a4899c54544071adc868dad6774dc423f64895aa5770c0e526b1286c9026ec660751abfe404b603ed96686c9435

Download Submit